A backdoor bypasses normal authentication. Sometimes it is intentional, built in by a developer for maintenance or debugging. Sometimes it is planted by an attacker after gaining access. Either way, it lets someone in without going through the front door. A backdoor may be a hidden account with a hardcoded password, a secret command that opens a shell, or a remote access tool that calls home to an attacker's server.

Backdoors are dangerous because they are invisible to standard security controls. A firewall sees normal traffic. An antivirus scan may miss a custom implant. The 2013 Target breach began with stolen credentials from an HVAC vendor, then the attackers installed backdoors to maintain access across months of exploration. Supply chain attacks plant backdoors in software updates, so thousands of organizations install the backdoor willingly. The SolarWinds compromise in 2020 did exactly that. Detecting backdoors requires monitoring for anomalous behavior, unusual outbound connections, and unexpected account activity. Removing them often means rebuilding the affected system from scratch. You cannot trust a machine that someone else has controlled.

Backdoor types

• Hardcoded credentials — hidden accounts built into software
• Remote access trojans — malware that gives an attacker control
• Web shells — scripts uploaded to a server for persistent access
• Supply chain implants — malicious code inserted into legitimate updates

Backdoors are not always malicious in origin. Some are leftovers from development that never got removed. Those are just as dangerous.